Guides
Authentication
Send your key in the Authorization header on every request: Authorization: Bearer hp_test_…. Keys in cookies or other headers are ignored.
Test and live keys
hp_test_…runs every check and never publishes. Free.hp_live_…publishes. Making one needs two-factor sign-in.
Keys are shown once. Roll or revoke them under Developers → API keys; the old key stops working at once. Never put a key in a browser, app bundle or public repository.
What a key can do
| Access | Can |
|---|---|
| Publish and read | Everything: posts, media, deletes, connect links, reads. |
| Drafts only | Drafts and media, and reads. Publishing answers 403 drafts_only. Made for AI agents. |
| Read only | Reads only. Writing answers 403 forbidden. |
Connect links need a key that can publish to create or revoke them, and read to list them.